Cloudflare logs 18.2 million DDoS attacks in Q3, exposing scale of hidden online bombardment
Cloudflare says it blocked 18.2 million network-layer DDoS attacks in the third quarter of 2026, a 38% jump from the previous quarter as short, intense barrages and DNS amplification assaults surged. With an average of 8,226 attacks every hour, the data shows how routine online bombardment has become for governments, companies and critical services.
The internet is under near-constant low-level attack, and the numbers from one of the largest web infrastructure providers show just how relentless the pressure has become.
Cloudflare reported that it blocked 18.2 million network-layer distributed denial-of-service (DDoS) attacks in the third quarter of 2026, up 38% from the previous quarter. On average, that works out to 8,226 separate DDoS events every hour—assaults designed to overwhelm servers or network links so that legitimate users can’t get through.
The company’s figures, published in a quarterly threat report, point to a sharp rise in specific attack styles. Short-burst DDoS incidents, where attackers unleash large volumes of traffic for brief periods to knock services offline before defenders can fully respond, surged 208%. DNS amplification attacks, which exploit misconfigured Domain Name System servers to magnify traffic aimed at a victim, jumped 215%.
For users, most of this activity is invisible until a website, banking app or government portal suddenly refuses to load. Behind the scenes, network operators, cloud providers and security teams are constantly filtering and absorbing malicious traffic so that daily services—from email to air-traffic updates—stay reachable. When those defenses fail or are overwhelmed, the impact can be immediate: payment terminals stop working, hospitals lose access to cloud-based records and news sites go dark during crises.
The targets of these campaigns, Cloudflare says, span sectors and geographies. Government ministries, financial institutions, gaming platforms, cryptocurrency exchanges and small online businesses all sit in the crosshairs. DDoS tools are cheap and widely available, which means they are used by a mix of actors: criminal gangs extorting companies for ransom, ideologically motivated groups trying to make a point, and in some cases state-linked operators probing rivals’ resilience.
Strategically, the surge in network-layer DDoS matters because it tests the plumbing of the internet itself. Unlike attacks that deface a website or steal data, volumetric DDoS campaigns go after routers, firewalls and bandwidth. Sustained or well-timed barrages against backbone links or widely used service providers can spill over, slowing or cutting off access for users far from the original target. For countries that rely heavily on online services, that kind of disruption becomes a national resilience issue, not just an IT problem.
The growth in short, intense attacks suggests adversaries are learning. By hammering a victim for minutes rather than hours, they can slip between scheduled monitoring intervals, avoid triggering some automated escalation procedures and still achieve meaningful disruption. The spike in DNS amplification reflects a slower-moving challenge: many vulnerable DNS servers remain exposed and misconfigured despite years of warnings, giving attackers abundant leverage points.
For companies and public-sector agencies, the data is a reminder that DDoS defense is no longer optional overhead but part of keeping basic operations running. The fact that a single provider is fielding tens of millions of attacks in a quarter implies that for many organizations, baseline traffic now includes an element of continuous hostile noise.
In this environment, availability is becoming as central to cybersecurity as confidentiality. Data that can’t be reached is as useless as data that has been stolen.
Key indicators to track in the coming months will be whether the upward trajectory in attack volumes holds into the next quarter, whether more backbone providers and telecoms report knock-on effects from large campaigns, and whether regulators in sectors like finance and healthcare begin mandating specific DDoS resilience standards as part of critical-infrastructure protection.
Sources
- OSINT